Someone Changed Admin Password?

Hi,
I just tried to login to my Ensim Admin and the password didn't work. The history via SSH shows that someone ran this command:

passwd_appl_admin password

So someone some how got in and reset the password. I ran a root kit and all was fine except:

Checking `sniffer'...
eth0 is not promisc
eth0 is not promisc
eth0 is not promisc


and

Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.6.0/i386-linux/.packlist /usr/lib/perl5/5.6.0/i386-linux/auto/F
ile/Spec/.packlist /usr/lib/perl5/5.6.0/i386-linux/auto/Mail/SpamAssassin/.packl
ist /usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Digest/MD5/.packlist /usr/lib
/perl5/site_perl/5.6.0/i386-linux/auto/Digest/Perl/MD5/.packlist /usr/lib/perl5/
site_perl/5.6.0/i386-linux/auto/MD5/.packlist /usr/lib/perl5/site_perl/5.6.0/i38
6-linux/auto/HTML/Tagset/.packlist /usr/lib/perl5/site_perl/5.6.0/i386-linux/aut
o/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Mail/.pac
klist /usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/MIME-tools/.packlist /usr/l
ib/perl5/site_perl/5.6.0/i386-linux/auto/Crypt/SSLeay/.packlist /usr/lib/perl5/s
ite_perl/5.6.0/i386-linux/auto/Crypt/RC4/.packlist /usr/lib/perl5/site_perl/5.6.
0/i386-linux/auto/Net/SSLeay/.packlist /usr/lib/perl5/site_perl/5.6.0/i386-linux
/auto/Text/CSV/.packlist /usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Class/Da
te/.packlist /usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/TimeDate/.packlist /
usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/URI/.packlist /usr/lib/perl5/site_
perl/5.6.0/i386-linux/auto/libwww-perl/.packlist /usr/lib/perl5/site_perl/5.6.0/
i386-linux/auto/Image/Magick/.packlist /usr/lib/bcc/include/.mot.cc.swp


What should I do?

 

 

 

 

Top